xp666 Privacy Policy — How We Protect Your Data in Pakistan

xp666 is an online gaming and sports betting platform serving players in Pakistan and other eligible jurisdictions. When you use xp666 — whether to place a bet on a cricket match, spin a slot, play live baccarat, or simply browse the platform — you share certain information with us. This Privacy Policy explains what that information is, why we need it, how we look after it, and what choices you have over it.

xp666 takes privacy seriously. The team that built this platform comes from Pakistan, and many of us use online platforms ourselves — we know how it feels when a service is vague about what it does with your data. That's why this policy is written the way it is: in plain language, without the kind of legal fog that makes most privacy policies unreadable. Every clause here reflects something we actually do, not something put there to fill space.

• This policy covers data collected through xp666.ws and any xp666-branded communications.
• Links to third-party payment processors or game providers in this policy refer to services that have their own separate privacy policies. xp666 is not responsible for third-party data practices.
• Questions about this policy can be directed to xp666 support at any time via live chat or email.

xp666 only collects data that is genuinely necessary for running the platform, complying with regulatory requirements, and providing you with a quality service. We do not collect data for the sake of it.

Data reaches xp666 through three main channels. Understanding these channels helps you know what you're sharing and when.

• Directly from you: When you complete the xp666 registration form, make a deposit, submit KYC documents, contact support, or fill in any form on the platform. This is information you actively provide.
• Automatically during use: When you visit xp666, our servers and analytics tools automatically record technical data — your IP address, the device and browser you're using, which pages you visited, how long you spent on them, and in-game activity such as bets placed and games played. This happens passively in the background and does not require any action from you.
• From third parties: xp666 may receive information from identity verification partners (to confirm the details you've provided match external records), payment processors (transaction status and fraud signals), and in some cases from the game providers whose products are embedded in the xp666 platform. This data supplements what you've given us directly and helps ensure platform integrity.

Every piece of data xp666 holds is used for one or more of the following legitimate purposes. We don't hold data without a reason, and we don't use data for purposes beyond what's listed here without your consent.

• Account operation: To create, maintain, and secure your xp666 account — including processing logins, managing your PKR wallet balance, and recording your transaction history.
• Payment processing: To handle PKR deposits via Easypaisa, JazzCash, NayaPay, SadaPay, IBFT, and card payments — and to process your withdrawals back to the same methods.
• Identity verification and KYC: To comply with anti-money laundering (AML) and know-your-customer (KYC) regulations. xp666 is required by its operating licence to verify the identity of players before processing large withdrawals.
• Fraud and abuse prevention: To detect and prevent fraudulent activity, multi-accounting, money laundering, underage gambling, and other forms of platform abuse. Technical and behavioural data is central to this function.
• Customer support: To understand and resolve your queries, complaints, and disputes when you contact xp666.
• Responsible gaming: To monitor for signs of problem gambling behaviour and, where relevant, to proactively offer support tools such as deposit limits or cooling-off periods.
• Product improvement: Aggregated and anonymised behavioural data helps xp666 understand how the platform is used, identify friction points, and prioritise improvements that genuinely benefit players.
• Marketing communications: To send you information about xp666 promotions, bonuses, and new features — but only if you have opted in, and only through channels you've agreed to. See Section 10 for full details on marketing.
• Legal compliance: To meet our obligations under applicable laws and regulations, including responding to lawful requests from regulatory or law enforcement bodies.

xp666 does not sell your personal data. Full stop. Data is shared with third parties only to the extent necessary to provide the service you're using and to meet our legal obligations.

• Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay, and IBFT bank infrastructure require transaction data to process your deposits and withdrawals. They receive only the minimum information necessary to complete the transaction.
• Identity verification partners: Licensed KYC providers receive your identity documents and reference data to verify that your registration details are accurate. These providers are bound by strict data handling agreements with xp666.
• Game providers: Evolution Gaming, Ezugi, Pragmatic Play, and other game studios embedded in xp666 may receive a session token and your betting activity within their games. They do not receive your full personal profile.
• Fraud detection services: Anonymised technical signals (IP, device fingerprint, behavioural patterns) may be shared with fraud intelligence services to detect account compromise and organised fraud attempts.
• Regulatory and legal authorities: Where xp666 is legally required to disclose information — for example, in response to a valid court order or regulator request — we will comply. We will notify you of such requests where legally permitted to do so.
• Business transitions: In the event of a merger, acquisition, or asset sale involving xp666, player data would form part of the transferred assets. Affected players would be notified in advance and given the opportunity to delete their accounts if they do not consent to the transfer.

xp666 uses cookies and similar technologies (local storage, session tokens) to make the platform work correctly and to understand how it's being used. Here's what each category does.

• Essential cookies: These keep you logged in, maintain your session, remember your language preference, and enable core platform functions. The xp666 platform cannot function without these cookies. They cannot be disabled without breaking your experience.
• Analytics cookies: These help xp666 understand aggregate usage patterns — which pages are visited most, where users encounter problems, how long sessions last. Data is anonymised before analysis. No individual player is profiled through analytics.
• Security cookies: Used for fraud detection, CSRF protection, and login security. These cookies are short-lived and contain no personally identifiable information.
• Preference cookies: Store your platform settings, such as your chosen deposit method or responsible gaming limits, so you don't have to re-enter them each session.

You can manage cookies through your browser settings. Disabling essential cookies will affect platform functionality. Disabling analytics cookies has no impact on your xp666 experience.

xp666 keeps your personal data for as long as your account is active and for the minimum period required by applicable law and regulation after account closure. We don't hold data longer than necessary.

• Account and transaction records: Retained for a minimum of 5 years after account closure to satisfy anti-money laundering (AML) record-keeping obligations. These records are held in secure, access-restricted storage during the retention period.
• KYC documents: Retained for 5 years after account closure or the last relevant transaction, whichever is later. After the retention period, KYC documents are permanently and securely deleted.
• Support communications: Chat transcripts and email records are retained for 3 years from the date of each communication, unless linked to an ongoing dispute.
• Technical and behavioural logs: Retained for a maximum of 13 months in identifiable form, then anonymised for aggregate analysis. IP logs are deleted after 12 months.
• Marketing data: If you have opted into marketing, your communication preferences are retained while your account is active and for 12 months after closure. After this period, marketing data is deleted.

xp666 applies a layered security approach to protect player data from unauthorised access, loss, or disclosure.

• Encryption in transit: All data transferred between your device and xp666 servers is encrypted using TLS 1.3 / SSL-256. The padlock icon in your browser confirms this is active.
• Encryption at rest: Sensitive data stored in xp666 databases — including KYC documents and financial reference data — is encrypted at rest using AES-256 encryption.
• Access controls: Employee access to personal data is restricted on a need-to-know basis. No xp666 staff member has blanket access to the full player database. Access is logged, audited, and reviewed regularly.
• Two-factor authentication (2FA): xp666 offers 2FA for player accounts. We strongly recommend enabling it in your account security settings. It provides an additional layer of protection against unauthorised access even if your password is compromised.
• Security monitoring: xp666 systems are monitored for unusual access patterns and potential breaches around the clock. Our security response protocols are tested regularly.
• Breach notification: In the event of a data breach that poses a risk to players, xp666 will notify affected players without undue delay and provide information on the nature of the breach and steps being taken to contain it.

You have clear rights over your personal data held by xp666. These rights are real and actionable — not buried in fine print. Here's what you can ask for and how to ask.

• Access: You can request a copy of all personal data xp666 holds about you. We'll provide it in a readable format within 30 days of your request.
• Correction: If any data xp666 holds about you is inaccurate or out of date, you can ask us to correct it. Name changes require documentary evidence due to KYC obligations.
• Deletion: You can request deletion of your xp666 account and associated personal data. Data that must be retained by law will be held in restricted storage; all other data will be permanently deleted within 30 days.
• Restriction: You can ask xp666 to restrict processing of your data in certain circumstances — for example, if you dispute the accuracy of your data while a correction is being processed.
• Portability: You can request your account data in a machine-readable format (CSV or JSON) for transfer to another service if required.
• Objection to marketing: You can opt out of all marketing communications from xp666 at any time without affecting your account access. See Section 10 for details.

xp666 sends promotional communications — bonus offers, new game announcements, seasonal promotions — only to players who have consented to receive them. We do not send marketing messages to players who have not opted in.

• Marketing consent is requested during registration and can be changed at any time from your xp666 account settings under "Communication Preferences".
• xp666 may communicate by email, SMS to your registered Pakistani mobile number, or WhatsApp — but only through channels you've explicitly agreed to.
• Each marketing communication from xp666 includes a clear, one-click unsubscribe link. Using it removes you from that specific channel immediately.
• Opting out of marketing communications has no impact on transactional messages — notifications about your deposits, withdrawals, or account security will continue regardless of your marketing preferences.
• xp666 does not share your contact details with third-party advertisers for their own marketing purposes under any circumstances.

xp666 is strictly for adults aged 18 and above. We do not knowingly collect or process personal data from anyone under the age of 18.

• Age verification is conducted at registration and at the point of large withdrawal requests. Accounts where the registered player is found to be under 18 will be permanently closed and all funds returned to the source payment method.
• If you believe a minor has registered an account on xp666, please contact us immediately at support@xp666.ws. We take these reports seriously and act on them immediately.
• Any personal data collected from a minor as a result of a falsified registration will be deleted as quickly as technically possible following identification of the breach.

xp666 operates servers and uses service providers located in multiple countries. When you use xp666 from Pakistan, your personal data may be processed in jurisdictions outside Pakistan — including the European Union, the United Kingdom, and Malta where our game providers are based.

• All cross-border data transfers involving personal data are governed by data processing agreements that require the receiving party to maintain data protection standards equivalent to those applied by xp666.
• Game providers integrated into xp666 — including Evolution Gaming (Malta/EU) and Ezugi (Israel/India) — process session data in their own jurisdictions under their own licences. These providers are subject to independent regulatory oversight.
• xp666 does not transfer personal data to jurisdictions that lack adequate data protection frameworks without ensuring that appropriate contractual safeguards are in place.

xp666 reviews this Privacy Policy regularly and updates it when our practices change, when we add new services, or when applicable law requires it.

• The "Last Updated" date at the top of this policy reflects when it was last revised.
• For material changes — those that significantly affect how we use your data or your rights over it — xp666 will notify registered players via email and a prominent in-platform notice at least 7 days before the change takes effect.
• Continued use of xp666 after the effective date of any change constitutes acceptance of the updated policy. If you do not agree, you have the right to close your account and request deletion of your data.

If you have any question about this Privacy Policy, want to exercise your data rights, or want to report a privacy concern, please reach out through any of the following channels.

• Live Chat: Available 24/7 on xp666 — the fastest channel for all enquiries including privacy questions.
• Email: support@xp666.ws — use the subject line "Privacy Request" for data rights requests to ensure prompt routing to the right team.
• Data Rights Requests: Submit your full name, registered email address, and a clear description of your request. xp666 will acknowledge within 48 hours and respond fully within 30 days.